Currently we help companies protecting their devices. Some of them are willing to shift to other AV products like Microsoft Windows Defender.

The challenge in these operations is to monitor the state of Antivirus products while and after reconfiguring. Together with the help of the great support team of Defender I could build a solution to this problem. To help others and working consistently I have putted the findings in a new PowerShell Module that is available for anyone from PowerShell Gallery and or GitHub.

Let me explain first why we need this Modules and or PowerShell cmdlets.

For PowerShell and Windows Defender there is the perfectly fine Get-MPComputerStatus.  And while the description of this cmdlet states: “This command gets the status of antimalware protection software installed on the computer.” to my finding it doesn’t provide that a generic status.

If I run this cmdlet while a Non-Microsoft antivirus product is installed and active the output looks as:

So can we check for the current state of any Antivirus product installed using a different approach?

From a user perspective we can monitor the current state via opening the custom protocol handler that is implemented by Windows Defender
windows windowsdefender://providers/ this is an easy way to open the correct dialog directly.

 

For the sake of this demonstration I installed 2 additional Antivirus Products. In this dialog you can see the current security products that are installed and monitored by Windows Security Center. Their respectively status is shown.

My goal is to gather this information by using PowerShell.

Specifically for antivirus products we can execute the following command to gather the information:

If you don’t have access to the CimInstance or WMI you could also try:

In the returned objects you will find the following fields

For registry this looks as:

Among others there is this productState (or STATE) value.

This value contains information about the statuses of the product.
By using the right equations you could also determine other statuses, for example if it is up-to-date.

On docs pages there is some documentation about the interface and actual api that exposes this information.

We can find out that the api exposes information about:

Enumerations

I couldn’t find any publicly available information about these Enumerations from Microsoft but there are others that gained some information from the W10 SDK.

From MS support we received confirmation that the productState bitmask flag is 0x0000F000 and the value for Enable should be 0x1000.

The value is set using Bit Fields, this is an object member which contains multiple members that stores the information in just a couple of bits.
More information about this: https://docs.microsoft.com/en-us/cpp/cpp/cpp-bit-fields

Using bitwise operators and some help from Microsoft Support we could figure out how we can determine the product status by using one equation.

I have made some PowerShell Enumerators to help creating readable code.

Using this information I wrote this little function that will return true of false.

As you can see in the Enumerators list, Enable isn’t the only status these products can have, also Snooze is a state. In that case we will return false too ofcourse.

It is possible to return the actual state that a given product currently is in. Bear in mind productState has multiple members. That is why we need to set a Bitmask to retrieve the correct state.

Below a couple of examples:

To help out others and to work consistent  among different scripts and projects I added some functions and enumerators to the PowerShell Module.
In 1 line of PowerShell code you can make use of this function.

TIP: Have a look at the function Add-ProductStates, this accepts array of products and adds members state and signatureStatus

 

I you have any requests or issues for this Module please let me know in this post or post an issue on the GitHub page.